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Abstract 


The  resurgence  of  interest  in  the  use  of  nuclear  technology  for  electrical  power  production 
has  resulted  in  a  desire  to  improve  the  existing  licensing  structure.  Improving  the  licensing 
structure  will  result  in  reduced  design  time  and  cost  for  new  reactor  plants.  An  improved 
regulatory  process  is  also  necessary  in  order  to  license  advanced  reactors  that  are  not  light 
water  technology.  Risk  based  reactor  licensing,  which  uses  the  Probabilistic  Risk 
Assessment  (PRA)  to  justify  most  licensing  questions,  is  a  proposed  replacement  for  the 
current  methods. 

This  work  further  develops  the  risk-based  regulatory  process  by  analyzing  a  portion  of  a 
new  reactor  concept.  A  reactor  similar  to  the  Pebble  Bed  Modular  Reactor  (PBMR)  is  the 
design  chosen  for  the  analyses.  The  designers  of  the  PBMR  assert  that  the  reactor’s 
inherently  safe  design  justifies  the  use  of  a  non-standard  containment  system.  This 
assertion  can  be  treated  as  a  design  question  to  be  justified  using  the  risk-based  approach. 
The  effect  of  the  changing  the  containment  system  is  incorporated  into  the  PRA  for  the 
PBMR. 

The  contributions  to  the  event  and  fault  trees  of  the  PBMR  are  determined  for  two 
casualties  that  affect  the  plants  decay  heat  removal  system.  The  initiating  event  for  both  of 
these  casualties  is  assumed  to  be  a  beyond  design  basis  earthquake. 

The  first  casualty  is  steam  blanketing  of  the  reactor  vessel  due  to  a  rupture  in  the  Reactor 
Cavity  Cooling  System  (RCCS).  This  casualty  is  shown  to  have  little  effect  on  the  safety 
of  the  plant.  The  second  casualty  was  failure  of  the  RCCS  due  to  operator  inaction.  If  this 
casualty  were  to  occur  the  reactor  vessel  has  the  possibility  of  failing  catastrophically.  The 
failure  of  the  reactor  vessel  could  result  in  damage  to  the  fuel  and  release  of  radionuclides. 
The  probability  of  this  casualty  resulting  in  a  significant  release  of  radionuclides  is 
7.5-10  *n  /  year.  For  the  two  casualties  evaluated  in  this  work,  the  use  of  a  non-standard 
containment  is  justified. 
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Chapter  1  Goal  and  Outline  for  this  Work 


This  chapter  states  the  goal  and  the  problem  statement  for  this  work.  Then  the 
motivation  behind  the  goal  and  the  plan  for  this  work  are  discussed.  An  outline  of  this 
work  is  also  provided  for  understanding  the  scope  of  the  project. 

1 .1  Goal  for  this  Work 

The  Nuclear  Regulatory  Commission  (NRC)  is  interested  in  improving  the  means  by 
which  reactor  plants  are  designed  and  licensed.  Risk-Based  goals  and  requirements  have 
been  given  serious  attention  due  the  advances  made  in  Probabilistic  Risk  Assessment 
(PRA)  techniques.  The  NRC  has  sponsored  a  project  to  determine  if  it  is  possible  to  use  a 
risk  based  approach  for  licensing  nuclear  reactors.  This  Risk-Based  approach  uses  the 
PRA  as  the  primary  measure  of  reactor  safety.  Developing  a  new  means  of  licensing 
reactors  is  particularly  important  when  considering  reactor  types  that  are  not  based  on  light 
water  reactor  technology.  Any  improved  licensing  method  must  be  able  to  be  applied  to 
advanced  reactor  types  in  order  for  it  to  be  of  use  by  both  the  Nuclear  Regulatory 
Commission  and  the  nuclear  reactor  designers. 

Analyzing  the  safety  of  a  reactor  design  is  a  large  task.  This  is  an  even  greater 
problem  when  the  reactor  is  different  from  those  for  which  there  is  past  experience.  There 
are  three  goals  for  this  work.  The  first  goal  is  to  identify  casualties  specific  to  the  Pebble 
Bed  Modular  Reactor.  The  second  goal  is  to  perform  the  deterministic  analysis  on  these 
casualties  to  determine  any  possible  effects  on  reactor  safety.  Finally,  probabilities  are 
assigned  to  any  outcomes  for  use  in  a  Risk-Based  analysis  of  the  Pebble  Bed  Modular 
Reactor. 

1.2  Problem  Statement 

An  improved  licensing  method  must  allow  for  the  development  and  construction  of 
new  reactor  types  in  the  United  States.  Risk-Based  Safety  Regulation  is  a  possible  method 
by  which  advances  in  reactor  technology  can  be  incorporated  into  the  United  States  nuclear 
industry.  In  an  effort  to  prove  the  viability  of  the  integrated  probabilistic  approach  this 


work  attempts  to  use  Risk-Based  methods  to  analyze  a  gas  cooled  reactor.  Eskom,  a 
South  African  utility  company,  is  designing  an  advanced  gas  cooled  reactor  called  the 
Pebble  Bed  Modular  Reactor  (PBMR).  This  reactor  is  designed  to  be  inherently  safe.  The 
designers  of  PBMR  state  that  a  standard  containment  system  is  unnecessary  to  ensure  the 
protection  of  the  public  due  to  the  reactor’s  safe  design.  This  work  will  explore  the 
validity  of  this  claim  using  the  risk-based  approach.  The  response  of  the  reactor  will  be 
analyzed  for  two  casualties  that  affect  its  decay  heat  removal  capability. 

1 .3  Motivation  and  Plan  for  this  work 

The  United  States  nuclear  industry  has  been  bogged  down  since  the  incident  at 
Three  Mile  Island.  An  adversarial  relationship  has  arisen  between  the  Nuclear  Regulatory 
Commission  and  the  nuclear  industry.  Designers  are  sometimes  hard  pressed  to  justify 
some  portions  of  their  reactor  designs  to  the  NRC.  Reactor  designers  and  NRC  officials 
sometimes  cannot  agree  on  the  requirements.  These  disagreements  result  in  longer 
certification  times  and  addition  of  unnecessary  redundancy  in  some  instances,  both  of 
which  lead  to  increasing  the  cost  of  the  reactor  plant.  This  research  is  being  conducted  on 
behalf  of  the  NRC. 

The  improved  licensing  structure  will  use  the  Probabilistic  Risk  Assessment  (PRA) 
as  the  primary  means  of  certification.  Currently,  the  PRA  is  used  to  justify  design  . 
decisions.  In  the  improved  licensing  structure  the  NRC  will  specify  PRA  standards  for 
various  events.  Then  the  engineers  will  have  specific  safety  goals  to  meet  while  designing 
the  reactor  plant.  When  the  PRA  is  completed,  all  uncertainty  in  the  analysis  will  be 
addressed  with  additional  testing,  defense  in  depth,  and  increased  safety  factors.  When  the 
time  comes  to  have  the  NRC  review  the  design,  the  engineers  will  only  have  to  justify  their 
PRA  calculations  and  their  handling  of  the  uncertainty.  The  approval  process  should  thus 
be  made  less  adversarial. 

A  Light  Water  Reactor  (LWR)  has  previously  been  analyzed  using  the  integrated 
probabilistic  approach.  There  is  a  large  amount  of  data  available  relating  to  LWR.  The 
analysis  proved  that  an  integrated  probabilistic  method  could  be  a  useful  tool.  But  in  order 
for  the  method  to  be  of  real  benefit  it  must  be  able  to  be  applied  to  advanced  reactor  types. 


There  is  very  little  experience  and  data  associated  with  advanced  reactors  in  the  United 
States.  A  new  licensing  structure  must  be  able  to  be  applied  to  these  designs.  In  this  work, 
the  contributions  to  the  event  and  fault  trees  for  a  portion  of  a  new  reactor  concept  are 
determined.  A  reactor  similar  to  the  PBMR  is  the  design  evaluated  in  this  work. 

The  PBMR  will  be  analyzed  using  the  risk-based  analysis  method.  First,  the 
overall  design  is  evaluated  for  it’s  response  to  a  large  earthquake.  Then  the  possible 
casualties  that  could  result  in  fission  product  release  to  the  environment  are  discussed. 
Next,  two  casualties  are  chosen  for  in-depth  analysis.  Then,  the  effect  of  this  casualty  on 
the  reactor  containment  is  evaluated.  Finally,  probabilities  and  uncertainties  will  be 
assigned  to  the  various  aspects  of  the  casualty  in  order  for  them  to  be  incorporated  into  the 
PRA  of  the  PBMR  to  help  determine  if  a  standardized  containment  system  is  necessary. 

1 .4  Report  Outline 

Chapter  2  describes  the  procedure  of  reactor  licensing  using  an  integrated  probabilistic 
approach. 

Chapter  3  is  a  description  of  the  Pebble  Bed  Modular  Reactor.  This  chapter  includes  a 
description  of  the  systems  and  specifications.  The  relevant  subsystems  are  also  discussed. 

Chapter  4  is  an  analysis  of  the  possible  casualties  that  could  lead  to  fission  product  release 
and  a  description  of  the  problem  that  is  used  in  this  case  study. 

Chapter  5  describes  the  methods  by  which  the  various  analyses  are  performed.  The  finite 
element  analysis  program  used  to  analyze  the  heat  transfer  of  the  PBMR  is  HEATING. 
This  chapter  explains  how  HEATING  works.  Then,  the  analysis  model  of  the  PBMR  is 
described.  Finally,  the  deterministic  methods  used  for  the  heat  transfer  and  structural 
response  are  described. 

Chapter  6  presents  the  results  of  the  analysis.  The  results  detail  the  effects  the  casualties 
have  on  the  vessel  temperature,  core  temperature,  and  structural  response. 

Chapter  7  is  a  discussion  of  how  the  deterministic  results  are  related  to  the  probability  of 
fission  product  release. 

Chapter  8  presents  the  conclusions  of  this  work  and  discusses  further  work  necessary  to 
complete  the  integrated  probabilistic  analysis  of  the  PBMR. 


Chapter  2  Description  of  the  Integrated  Probabilistic 
Approach  to  Reactor  Licensing 


This  chapter  discusses  the  problems  with  the  current  licensing  structure.  Then  the 
goals  for  nuclear  regulatory  reform  are  stated.  Finally,  the  method  by  which  probabilistic 
analysis  can  be  used  to  improve  the  licensing  of  nuclear  reactors  is  discussed.  The 
majority  of  the  information  in  this  chapter  is  based  on  a  presentation  given  at  the  June 
2001  ACRS  Workshop  titled  “A  New  Risk-Informed  Design  and  Regulatory  Process”[l]. 

2.1  Motivations  for  Regulatory  Reform 

One  of  the  primary  motivations  for  reforming  the  regulatory  system  is  that  the 
enormous  capital  costs  and  financial  uncertainties  associated  with  licensing  and 
constructing  nuclear  power  plants  have  restricted  U.S.  utilities  from  ordering  any  Nuclear 
Power  Plants  (NPP)  in  the  past  two  decades.  In  the  deregulated  electricity  market,  nuclear 
power  plants  are  even  less  economically  attractive  because  these  start-up  costs  hinder  the 
possibility  of  a  timely  return  on  investment.  On  the  other  hand,  some  socio-economic 
factors  have  simultaneously  increased  the  appeal  of  nuclear  power  as  a  viable  option  for 
power  production.  Compared  to  the  fossil  fuels  used  by  coal,  gas  turbine,  and  natural  gas 
plants,  nuclear  fuels  cost  utilities  far  less  per  megawatt.  This  disparity  in  cost  grows  each 
day  as  fossil  fuels  become  scarcer  and  more  expensive.  Additionally,  nuclear  power 
provides  electricity  without  the  immediate  environmental  impacts  of  fossil  fuel-burning 
plants.  The  U.S.  government  has  repeatedly  voiced  its  concern  over  America’s  growing 
dependence  on  foreign  oil.  Increasing  electricity  consumption,  stricter  air  pollution 
standards  and  continuing  unrest  in  the  oil-rich  Middle  East  has  forced  the  U.S.  to  diversify 
its  energy  production  profile  [2].  The  Department  of  Energy  and  power  production 
industry  have  indicated  that  nuclear  power  will  continue  to  play  a  vital  role  in  the  U.S. 
energy  profile.  In  order  to  spur  new  NPP  construction,  the  start-up  costs  for  a  NPP  must 
be  reduced,  while  still  maintaining  adequate  public  protection. 

Public  opposition  to  nuclear  power  has  by  no  means  vanished  but  rather  waned  in 
the  absence  of  high-profile  safety  incidents  since  Three-Mile  Island.  Environmental, 


political,  and  economic  turmoil  surrounding  fossil  fuels  has  further  drawn  the  spotlight  of 
criticism  away  from  nuclear  power.  Additionally,  the  commercial  nuclear  power  industry 
boasts  an  excellent  and  well-documented  safety  record.  As  a  result,  the  nuclear  power 
industry  argues  that  it  often  endures  unjustified  regulatory  burden  without  significant  or 
demonstrable  safety  benefit.  Accordingly,  the  Nuclear  Regulatory  Commission  has 
accelerated  efforts  to  re-evaluate  and  reform  those  regulations  governing  the  licensing, 
construction,  operation,  and  decommissioning  of  commercial  nuclear  power  plants.  The 
NRC  hopes  to  reduce  the  enormous  capital  costs  preventing  utilities  from  building  NPPs, 
while  still  adequately  protecting  the  public  from  the  unlikely,  yet  possible,  dangers  of 
nuclear  power.  Furthermore,  the  existing  regulatory  framework  cannot  accommodate 
some  advanced  light-water  reactors  (LWR)  and  non-LWR  types  currently  being  considered 
as  new  projects  by  utilities  within  the  U.S.,  pending  results  from  foreign  projects.  Thus, 
the  U.S.  urgently  needs  a  new  regulatory  approach  to  licensing  nuclear  power  plants.  This 
improved  regulatory  framework  must  continue  to  ensure  adequate  public  protection  while 
reducing  costs  and  providing  guidance  for  the  regulation  of  advanced  reactor  types. 

2.2  Problems  with  the  Current  Regulatory  Procedures 

The  design  and  regulatory  process  that  was  employed  traditionally  and  is  still  used 
today  consisted  of  the  following  steps.  First,  the  designer  develops  a  plant  design  that  both 
produces  power  reliably  and  operates  safely.  The  designer  uses  high  level  regulatory 
criteria  and  policies  as  inputs.  Next,  the  regulator  reviews  the  design.  The  designer  and 
regulator  then  engage  in  a  dialog.  This  dialog  involves  specifying  safety  features,  their 
performance  criteria,  and  methods  of  design  and  analysis.  Throughout  this  process  the 
designer  documents  the  design  basis  while  the  regulator  documents  the  safety  evaluation, 
policies  established,  and  criteria  for  future  reviews. 

Any  reform  of  the  regulatory  process  needs  to  help  overcome  the  problems 
associated  with  the  current  structure.  These  problems  are: 

•  The  certification  process  is  extremely  long. 

•  Regulation  is  primarily  concerned  with  deterministic  calculations  without  explicit 
consideration  for  uncertainty. 


•  Regulatory  decisions  on  specific  issues  are  made  in  isolation,  resulting  in  an 
inefficient  and  incoherent  licensing  structure. 

•  Deterministic  analysis  combined  with  subjective  judgment  has  led  to  the  practice  of 
layering  on  of  redundant. 

This  layering  on  of  redundant  systems  is  called  defense  in  depth.  This  practice  has 
been  one  of  the  primary  means  used  to  address  regulators  concerns.  In  some  cases  it  is 
warranted,  but  in  other  cases  unnecessarily  drives  up  the  construction  and  operating  cost  of 
plants.  The  goal  of  this  work  is  to  determine  if  it  is  possible  to  use  a  risk-informed  design 
process  to  evaluate  a  portion  of  an  advanced  reactor  design. 

2.3  Goals  for  Regulatory  Reform 

The  current  regulatory  policies  have  resulted  in  designers  having  difficulty  getting 
a  reactor  certified  when  the  design  differs  from  those  that  have  been  previously  certified. 
The  result  of  these  difficulties  is  a  nuclear  industry  that  has  been  unwilling  to  invest  in 
advances  in  reactor  design,  even  when  design  improvements  could  result  in  much  safer 
operations.  Light  Water  Reactors  (LWR)  have  a  great  deal  of  technological  inertia  in  the 
United  States  nuclear  industry,  due  to  the  fact  that  all  current  requirements,  test  procedures, 
and  manufacturing  infrastructure  are  based  on  LWR.  This  technological  inertia  combined 
with  inefficient  regulatory  structure  has  resulted  in  very  slow  progress  in  our  nuclear 
industry.  The  Goals  for  regulatory  reform  are: 

•  Create  methods  to  assure  consistency  of  nuclear  power  plant  applicants  and 
regulators  in  performance  and  goals  for  producing  safe,  economical  power. 

•  Change  the  adversarial  nature  of  the  current  licensing  structure. 

•  Create  a  licensing  structure  that  is  adaptable  for  a  wide  range  of  reactor  types. 

2.4  Description  of  Probabilistic  Regulatory  Approach 

In  recent  decades,  the  techniques  of  PR  A  have  reached  a  level  of  maturity  and 
acceptability  justifying  the  extensive  incorporation  of  PRA  in  any  new  regulatory 
philosophy.  In  essence,  PRA  calculates  the  frequency  (events  per  year)  with  which 


undesirable  sequences  of  events  will  occur.  Certain  known  combinations  of  low-level 
events  (pipe  breaks,  valve  failures,  operator  errors,  etc)  must  occur  in  order  to  cause  a 
given  high-level  event  (core  damage,  radionuclide  release,  etc).  The  frequencies  of  high- 
level  events  can  then  be  calculated  using  fault  tree  or  event  tree  logic  and  the  frequencies 
of  low-level  events.  The  frequencies  of  low-level  events  from  historical  data,  traditional 
deterministic  analyses,  and  expert  opinion  are  calculated.  Hence,  PRA  provides  us  with  a 
manner  for  quantifying  safety,  rather  that  relying  upon  vague  terminology  such  as  ‘not 
safe’,  ‘safe  enough’  or  ‘extremely  safe’  [3]. 

The  overall  goal  for  safety  and  regulatory  reform  for  the  nuclear  power  industry 
should  be  to  create  methods  to  assure  consistency  of  nuclear  power  applicants  and 
regulators  in  performance/goals  for  producing  safe,  economical  power  plants.  Successful 
electric  power  production  is  based  on  two  key  issues.  First,  the  production  of  electrical 
power  must  be  economically  feasible;  otherwise  it  will  be  replaced  by  another  means  of 
productions.  Second,  the  power  must  be  produced  in  a  safe  manner.  Power  production 
that  poses  a  significant  risk  to  the  public  or  environment  is  not  acceptable.  Both  of  these 
issues  must  be  accounted  for  in  any  design  and  regulatory  procedures. 

The  theory  behind  a  risk  informed  design  and  regulatory  process  is  that  all 
regulatory  decisions  should  be  based  on  the  informed  beliefs  of  decision  makers.  These 
beliefs  can  and  should  be  stated  in  a  probabilistic  format.  The  basic  equation  governing  a 
probabilistic  determination  of  an  event  with  a  given  Probability  Density  Function  (PDF)  is: 

Probability  (x<X<X+dx)  =  f(x)  dx  (for  a  continuous  distribution) 

The  regulator  acceptance  criteria  must  reflect  acceptable  best-estimate  performance 
expectations  and  uncertainties.  Regulatory  questions  and  acceptance  criteria  should  also 
be  stated  within  a  probabilistic  framework.  This  framework  should  be  as  comprehensive 
as  possible  [1]: 

•  Utilize  probabilistic  and  deterministic  models  and  data  where  feasible.  Use 

subjective  judgment  where  these  models  are  not  feasible. 

•  State  all  subjective  judgments  probabilistically  and  incorporate  them  into  the  PRA. 


•  Require  both  license  applicant  and  regulatory  staff  to  justify  their  decisions 
explicitly. 

•  Initiate  resolution  process  to  resolve  applicant-regulator  disagreements. 

The  risk  informed  regulatory  approach  for  nuclear  power  plant  evaluation  is 
performed  probabilistically  and  is  supported  by  deterministic  analyses,  tests,  experience, 
and  judgments  at  all  conceptual  stages  of  development.  Safety  results  of  defense-in-depth, 
performance  margins,  best-estimate  performance,  and  subjective  judgments  are  all 
incorporated  into  a  comprehensive  PRA.  The  PRA  is  used  to  state  the  evaluator’s  beliefs 
concerning  system  performance.  The  level  of  detail  of  acceptance  criteria  becomes  finer  as 
the  level  of  concept  development  increases.  Figure  2. 1  is  a  diagram  of  the  Risk-Informed 
Design  and  Regulatory  process. 

Current  licensing  structures  require  reactor  designs  to  be  proven  safe  for  Design 
Basis  Accidents  (DBA).  Unfortunately,  these  DBAs  are  based  on  Light  Water  Reactors 
(LWR)  designs.  When  a  reactor  design  differs  greatly  from  the  existing  LWRs,  some  of 
the  design  basis  accidents  become  irrelevant.  Also,  different  reactors  designs  will  have  to 
be  analyzed  for  casualties  that  do  not  apply  for  LWR.  For  example,  a  High-Temperature 
Gas  Reactor  (HTGR)  is  susceptible  to  a  water  ingress  casualty  which  is  meaningless  for  a 
LWR.  A  risk-informed  licensing  structure  must  be  adaptable  for  various  designs. 
Reference  [1]  provides  a  description  of  how  to  develop  casualties  for  new  reactor  designs. 


Figure  2.1  Risk-Informed  Design  and  Regulatory  Process  {1] 
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Chapter  3  Description  of  the  Pebble  Bed  Modular 
Reactor 


The  analysis  of  this  work  is  performed  using  a  reactor  similar;  but  not  identical  to 
the  PBMR.  The  major  characteristics  are  the  same  for  both  the  notional  reactor  and  the 
actual  PBMR.  This  chapter  contains  a  description  of  the  PBMR.  First,  a  brief  history  of 
the  pebble  bed  technology  and  how  it  came  to  used  is  given.  Then  the  current  reactor 
design  is  discussed.  Finally,  the  support  systems  relevant  to  this  work  are  described.  The 
information  provided  in  this  chapter  is  extensive  and  additional  information  can  be  found 
in  references  [4,  5]. 

3.1  History  of  the  Pebble  Bed  Reactor  Type 

Eskom  Ltd.,  the  nation  utility  of  South  Africa  currently  has  about  34,000Mwe  of 
generating  capacity,  primarily  coal  plants  with  some  hydro  power  and  two  nuclear  plants 
located  in  southwest  South  Africa  near  Cape  Town.  There  is  a  growing  demand  for 
electrical  power  in  the  region.  Eskom  compared  several  alternatives  for  power  generation 
and  decided  that  LWR  were  too  expensive.  It  was  decided  that  coal  fired  power  plants 
were  not  advantageous  since  the  power  demand  is  growing  in  the  south  and  all  of  the  coal 
is  located  in  the  north  of  the  country. 

Eskom  decided  to  use  German  pebble  bed  technology,  which  was  an  ultra-safe 
system,  so  they  could  concentrate  on  the  economics  of  the  system.  Modular  plants  of  a 
modest  size  were  selected  to  take  advantage  of  economical  benefit  of  many  identical 
systems.  As  power  demand  increases  additional  power  units  can  be  added.  Eskom  and 
their  partners  envision  that  the  PBMR  technology  could  be  exported  world-wide  because 
of  its  safety  and  attractive  economics.  The  partners  in  this  venture  British  Nuclear  Fuels 
(BNFL),  Excelon,  and  Industrial  Development  Corporation  of  South  Africa  (IDC)  [4,  5]. 
For  further  information  on  the  PBMR  please  see  the  Eskom  website. 


3.2  General  Description  of  the  Pebble  Bed  Modular  Reactor 

The  PBMR  concept  is  based  on  German  high  temperature  helium  cooled  pebble 
bed  reactor  technology  demonstrated  at  the  AVR  and  THTR  reactors.  The  PBMR  is  a 
modular,  graphite  moderated,  helium  cooled,  pebble  bed  type  reactor  that  uses  a  Brayton 
direct  gas  cycle  to  convert  the  heat  into  electrical  energy  by  means  of  a  helium  turbo¬ 
generator.  A  regenerative  heat  exchanger,  called  a  recuperator,  is  used  to  improve  the 
thermodynamic  efficiency.  The  PBMR  plant  specifications  developed  by  Eskom  are  given 
below  in  Table  3.1  [5]. 


Table  3.1  PBMR  Plant  Specifications 


Maximum  Power  Output 

268  MW  thermal 

Continuous  Stable  Power  Range 

0-100% 

Anticipated  Cost  (nth  module) 

$1000 /KWe 

Construction  Schedule 

24  Months 

Outage  Rate 

2%  planned  &  3%  forced 

O&M  and  Fuel  Costs 

$4-5  /  MWHr 

Emergency  Planning  Zone 

<  400  meters 

Plant  Operating  Life  Time 

40  years 

Maximum  Operating  Temperature 

900  °C 

Maximum  Operating  Pressure 

7  MPa 

The  PBMR  has  a  large  core  with  a  low  power  density.  The  helium  coolant  remains 
in  a  gaseous  phase  and  is  inert.  The  layout  of  the  PBMR  reactor  plant  is  shown  in  Figure 
3.1.  The  plant  is  a  traditional  closed  gas  cycle  turbine  system  using  a  recuperator  to 
improve  the  thermodynamic  efficiency.  The  Power  Control  System  varies  the  power  of 
the  reactor  by  changing  the  amount  of  helium  in  the  system. 
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Figure  3.1  PBMR  Plant  Layout  [5] 

3.3  Description  of  the  Pebble  Bed  Reactor  Fuel  Design 

• 

One  of  the  most  important  safety  features  of  the  PBMR  is  the  fuel  design.  The 
PBMR  uses  spherical  pebbles  60  mm  in  diameter,  each  impregnated  with  about  15,000 
^  enriched  (8%  U-235)  uranium  particles  coated  using  the  three-layer  TRISO  particles 

shown  in  Figure  3.2.  These  fuel  particles  can  withstand  very  high  temperatures  prior  to 
releasing  fission  products.  The  German  test  facility  indicated  that  the  fuel  particles  can 
withstand  temperatures  of  about  1700  °C  with  no  significant  damage  and  up  to  2200  °C 
®  with  damage  limited  to  about  0.01%  of  the  fuel.  Figure  3.3  shows  the  results  of  the 

German  tests  of  the  TRISO  fuel  particles  [5]. 
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Figure  3.3  Results  of  TRISO  Fuel  Particle  Tests  [5] 
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3.4  PBMR  Core  Description 


m 


The  PBMR  core  is  3.5  meters  in  diameter  and  8.5  meters  high.  The  core  consists  of 
two  regions.  The  cylindrical  inner  region  is  filled  with  approximately  1 10,000  moderating 
balls  which  are  only  graphite.  The  fuel  balls  are  housed  in  an  annular  region  that 
surrounds  the  center  reflector.  There  are  approximately  336,000  pebbles  in  the  fuel  region. 
This  arrangement  flattens  out  the  power  distribution.  About  5,000  pebbles  are  cycled 
through  the  core  each  day.  They  are  monitored  for  fuel  burnout;  in  order  to  determine  if 
they  should  be  sent  back  to  the  top  of  the  core  or  to  the  spent  fuel  holding  area.  The  core 
has  a  large  negative  temperature  coefficient,  which  adds  to  its  safety. 

The  core  is  surrounded  by  a  graphite  reflector.  The  reactivity  control  and  shutdown 
system  consists  of  two  subsystems.  The  primary  means  of  reactivity  control  are  control 
rods.  These  rods  are  fully  inserted  to  shutdown  the  reactor.  At  power,  the  control  rods 
primary  purpose  is  to  make  up  for  xenon  transients.  The  second  subsystem  is  the  Small 
Absorber  Spheres  (SAS),  which  are  used  as  an  emergency  backup  system. 

3.5  Overall  Plant  Layout  and  Containment  System 

The  plant  will  consist  of  a  single  building  approximately  50  x  26  meters  and  42 
meters  in  height,  with  21  meters  below  ground  level.  The  reactor  will  be  contained  in  a 
citadel.  The  citadel  will  house  the  reactor  inside  the  Reactor  Cavity.  The  turbo¬ 
compressors  and  Power  Turbine  will  be  contained  within  Power  Conversion  Unit  (PCU). 
Figure  3.4  is  a  side  view  of  the  PBMR  building.  This  figure  shows  the  positions  of  the 
Reactor  Cavity  and  the  PCU.  The  containment  system  is  also  shown  in  Figure  3.4. 

In  the  event  of  a  large  rupture  in  the  reactor  cavity,  the  containment  system 
prevents  over-pressurization  by  relieving  pressure  into  the  adjacent  PCU.  If  pressure  is 
still  too  high,  lift  plates  in  the  PCU  relieve  pressure  by  venting  citadel  into  the  building. 
The  building  itself  has  pressure  relief  dampers  that  relieve  excess  pressure  to  the 
atmosphere.  The  sequential  barriers  posed  by  the  containment  system  act  to  contain 
fission  products  first  to  citadel  and  then  to  the  building.  There  is  also  a  pressure  relief 
shaft  that  has  a  rupture  disk  which  actuates  to  protect  the  citadel  from  small  to  medium 


14 


size  raptures;  it  is  equipped  with  a  filtration  system.  Eskom  analysis  shows  that  this  design 
in  combination  with  the  inherent  safety  of  the  PBMR  design  prevents  the  need  for  a 
standard  containment  system  [5].  According  to  Eskom,  the  requirement  of  a  standard 
containment  system  would  make  the  PBMR  economically  unfeasible. 


Figure  3.4  Plant  Layout  and  Containment  System  [5] 

3.6  Description  of  the  Reactor  Cavity 

The  analysis  portion  of  this  work  deals  primarily  with  the  casualty  response  of  the 
PBMR.  Proper  modeling  of  the  reactor  cavity  is  very  important  for  accurate  response 
calculations.  The  reactor  cavity  contains  several  systems.  For  this  casualty  analysis  the 
most  important  components  to  be  modeled  are  the  reactor  and  the  Reactor  Cavity  Cooling 


System  (RCCS).  The  reactor  vessel  is  supported  by  mounts  that  allow  for  thermal 
expansion  and  contraction.  The  reactor  is  unlagged  in  belt  region.  This  allows  for  heat  to 
be  removed  from  the  reactor  vessel  via  radiation  and  convection.  In  normal  operation 
water  circulates  through  the  RCCS  removing  heat  from  the  reactor  cavity.  The  reactor  and 
its  attached  subsystems  are  sometimes  referred  to  as  the  Reactor  Unit. 

Figure  3.5  is  a  cutaway  view  of  the  reactor  cavity  showing  the  location  of  the  various 
components.  This  figure  is  based  on  data  obtained  from  the  PBMR  Safety  Analysis  Report 
(SAR)  [5].  The  RCCS  consists  of  45  cylinders  that  are  22.5  meters  tall.  The  system 
consists  of  three  identical  and  independent  subsystems.  The  RCCS  is  one  the  primary 
design  features  that  makes  the  PBMR  inherently  safe.  A  more  detailed  description  of  the 
RCCS  is  included  in  Appendix  A  [5]. 

3.7  Cooling  Systems 

Several  cooling  systems  are  required  for  proper  operation  of  the  PBMR.  The 
ultimate  heat  sink  for  the  initial  PBMR  test  facility  will  be  sea  water.  The  sea  water  is 
distributed  to  the  various  other  cooling  systems  via  the  Open  Circuit  Cooling  System. 
Figure  3.6  shows  the  loads  supplied  by  the  Open  Circuit  Cooling  System  [5].  The  backup 
cooling  tower  is  used  in  emergency  situations,  where  power  is  lost  to  the  open  circuit 
cooling  pumps. 

The  RCCS  normally  cooled  by  the  open  circuit  cooling  water.  The  backup  cooling 
tower  supplies  flow  to  the  RCCS  when  electrical  power  is  lost  to  the  open  circuit  cooling 
pumps.  The  pumps  that  circulate  water  to  the  backup  cooling  tower  are  powered  from 
emergency  diesel  generators.  In  the  event  of  a  loss  of  all  electrical  power,  the  RCCS 
system  is  designed  to  boil  off  over  time  removing  heat  from  the  reactor  cavity.  The  PBMR 
SAR  states  that  there  is  enough  water  in  the  RCCS  to  keep  the  reactor  cavity  cool  for  three 
days  without  flow  of  circulating  water.  The  RCCS  can  also  be  supplied  by  fire  hoses,  if 
electrical  power  is  unavailable.  The  ability  of  RCCS  to  remove  heat  from  the  reactor 
cavity,  without  any  external  motive  force,  is  one  of  the  design  characteristics  that  make  the 
PBMR  and  inherently  safe  design. 
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Figure  3.6  Active  Cooling  System  Flow  Diagram 


Chapter  4  Preliminary  Casualty  Analysis 


The  goal  of  any  reactor  designer  is  to  have  a  final  plant  that  produces  safe  and 
economical  power.  In  order  for  a  plant  to  be  considered  safe  it  must  not  pose  a  health  risk 
to  either  the  operators  or  the  public.  The  primary  concern  for  public  safety  is  the  release  of 
radioactive  contaminants  from  the  reactor  building  to  the  surrounding  environment.  This 
chapter  discusses  the  possible  causes  of  fission  product  release  from  the  PBMR  and 
identifies  the  specific  casualties  for  which  deterministic  analysis  is  performed. 

4.1  Causes  for  Fission  Product  Release 

All  of  the  paths  through  which  fission  products  could  be  released  require  multiple 
elements  in  the  reactor  design  to  fail.  The  possible  means  of  fission  product  release  are 
best  described  by  a  diagram.  Figure  4.1  is  a  Master  Logic  Diagram  for  a  notional  nuclear 
reactor.  As  can  be  seen  in  the  diagram  the  causes  for  fission  product  release  are: 

•  Coolant  Inventory  Excursion 

•  Reactivity  Excursion 

•  Temperature  Excursion 

•  Pressure  Excursion 

Figure  4.1  is  applicable  for  a  light  water  reactor  [1].  The  casualties  that  can  cause 
fission  product  release  must  cause  damage  to  the  fuel,  escape  of  fission  products  from  the 
primary  pressure  boundary,  and  escape  of  the  fission  products  from  the  containment 
building.  The  same  holds  true  for  the  PBMR.  However,  due  to  the  design  of  the  PBMR 
reactor  design,  damage  to  the  fuel  from  high  temperatures  is  unlikely.  The  high 
temperature  characteristics  of  the  fuel  (see  Figure  3.3)  result  in  the  vessel  reaching  its 
melting  point  long  before  the  fuel  exceeds  a  temperature  where  fission  product  release,  is 


Master  Logic  Diagram 


Figure  4.1  Master  Logic  Diagram 


For  this  research  the  initiating  event  of  the  casualty  is  assumed  to  be  a  beyond 
design  basis  earthquake.  The  possible  consequences  for  this  event  are  evaluated.  Some  of 
the  possible  casualties  during  an  earthquake  are:  loss  of  all  electrical  power  (normal  and 
backup),  incapacitation  of  operators,  rupture  of  helium  coolant  system,  collapse  of 
building,  and  rupture  of  cooling  systems.  Casualties  are  chosen  for  analysis  to  determine  if 
they  will  result  in  fission  product  release.  Analysis  by  Eskom  has  shown  that  a 
Depressurized  Loss  of  Coolant  (DPLOC)  casualty  would  not  result  in  fuel  damage  [5], 

The  total  collapse  of  the  building  is  deemed  unlikely.  A  reactivity  excursion  would  not 
result  from  an  earthquake  due  to  the  reactivity  control  and  shutdown  system.  The  fuel 
could  be  damaged  by  chemical  attack  if  water  or  air  entered  the  core,  but  neither  of  these 
casualties  is  likely  due  to  the  plant  design. 

The  PBMR  relies  on  the  proper  operation  of  the  RCCS  in  order  to  remove  decay 
heat  that  is  generated  in  the  core  following  the  reactor  scram.  Impairing  the  operation  of 
the  RCCS  is  a  possible  cause  of  mechanical  failure  of  the  reactor  vessel.  Normally,  the 
PBMR  transfers  its  heat  to  the  RCCS  via  radiation  and  convection  heat  transfer.  Thermal 
analysis  of  the  reactor  shows  that  the  fuel  will  not  be  damaged  prior  to  vessel  failure  due  to 
the  high  temperature  characteristics  of  the  fuel.  However,  catastrophic  failure  of  the 
reactor  vessel  could  result  in  fuel  damage  due  to  mechanical  shock,  thermal  shock,  or 
chemical  attack.  The  deterministic  portion  of  this  research  deals  with  two  possible 
methods  by  which  the  passive  decay  heat  removal  of  the  PBMR  could  be  impaired. 

4.2  Description  of  the  Chosen  Casualties 

For  the  first  casualty  the  following  is  a  sequence  of  events  that  are  assumed  to 
occur  for  which  the  deterministic  analyses  are  applicable.  First  a  loss  of  all  electrical 
power  occurs.  Then  reactor  scrams.  Operators  at  the  plant  are  incapacitated.  A  rupture  of 
one  of  the  RCCS  tubes  occurs  in  the  reactor  cavity.  This  rupture  sprays  water  onto  the 
reactor  vessel  which  is  initially  at  279  °C.  This  water  flashes  to  steam.  Steam  fills  the 
reactor  cavity.  The  steam  displaces  air  in  the  reactor  cavity.  Radiation  heat  transfer  from 
the  reactor  vessel  to  the  RCCS  cylinders  is  reduced  by  the  steam  in  the  gap  between  the 


vessel  and  RCCS.  This  reduction  in  heat  transfer  results  in  higher  vessel  temperatures  that 
under  normal  operations. 

The  first  deterministic  analysis  deals  with  determining  the  effect  water  vapor  has 
on  the  overall  heat  transfer  out  of  the  reactor  vessel.  This  is  a  casualty  that  has  not  been 
analyzed  for  by  Eskom.  Figure  4.2  is  a  flowchart  of  how  the  decay  heat  is  transferred 
through  the  reactor  and  to  the  surrounding  RCCS  cylinders.  The  effect  of  having  a 
damaged  RCCS  subsystem  is  shown.  In  Chapter  6  the  effect  on  vessel  temperature  of  the 
steam  is  shown  to  be  negligible. 

The  second  casualty  chosen  for  analysis  also  involved  the  RCCS.  Without  pumps 
running  the  RCCS  system  operates  by  transferring  decay  heat  to  water  in  the  cylinders. 

The  water  boils  off  and  is  vented  from  the  reactor  cavity  area.  The  cylinder  temperatures 
stay  at  approximately  100  °C,  while  the  water  is  boiling  off.  The  water  in  the  cylinders  can 
remove  a  great  deal  of  heat  from  the  reactor  vessel  without  exceeding  design  temperature 
limits.  The  PBMR  SAR  states  that  the  RCCS  system  should  operate  in  the  boil  off  mode 
for  3  days  before  it  ceases  to  function  due  to  loss  of  water.  If  the  water  is  not  replenished 
by  operators  the  system  ceases  to  function  and  vessel  temperatures  can  start  to  rise.  The 
second  casualty  determines  the  effect  of  operators  failing  to  refill  the  RCCS. 

The  PBMR  reactor  vessel  is  made  of  SA  508  mild  steel.  Yield  strength  and 
modulus  of  elasticity  of  carbon  steel  vary  with  temperature.  At  elevated  temperatures  (> 
600  °C)  the  yield  strength  is  greatly  reduced.  Rupture  of  the  vessel  and  subsequent 
damage  to  the  fuel  is  possible  if  vessel  temperature  becomes  too  high.  Fission  products 
can  then  be  released  from  the  fuel  and  reactor.  The  rupture  causes  the  pressure  in  the 
reactor  cavity  to  rise  and  the  pressure  relief  systems  associated  with  the  citadel  complex 
will  be  actuated.  The  initial  relief  of  the  helium  prior  to  fuel  damage  removes  the  primary 
motive  force  that  could  transport  the  radionuclides  which  are  formed  from  damaged  fuel. 


Rupture  in  a  RCCS  Cooling 
Chamber  during  an  Earthquake 


Figure  4.2  Damaged  RCCS  Casualty  Flowchart 


Chapter  5  Deterministic  Methods  Used 


This  chapter  describes  the  methods  used  to  analyze  the  casualty  response  of  the 
notional  PBMR.  First  the  HEATING  finite  element  analysis  program  is  described.  Next 
the  heat  transfer  model  used  in  the  analysis  is  described.  The  analytical  equations  used  in 
the  heat  transfer  model  are  explained.  Finally,  a  description  of  the  reactor  vessel  structural 
equations  is  given.  The  notional  PBMR  is  referred  to  as  simply  the  PBMR  in  this  and  the 
following  chapters. 

5.1  Description  of  HEATING 

The  heat  transfer  analysis  program  used  in  this  research  was  developed  by  Oak 
Ridge  National  Labs.  A  detailed  description  of  the  program  can  be  found  in  reference  [7]. 
“HEATING  is  a  general-purpose  conduction  heat  transfer  program  written  in  Fortran  77. 
HEATING  can  solve  steady-state  and/or  transient  heat  conduction  problems  in  one-,  two-, 
or  three-dimensional  Cartesian,  cylindrical  or  spherical  coordinates.  A  model  may  include 
multiple  materials,  and  the  thermal  conductivity,  density,  and  specific  heat  of  each  material 
may  be  both  time-  and  temperature-dependent.  The  thermal  conductivity  may  also  be 
anisotropic.  Materials  may  undergo  change  of  phase.  Thermal  properties  of  materials  may 
be  input  or  may  be  extracted  from  a  material  properties  library.  Heat-generation  rates  may 
be  dependent  on  time,  temperature,  and  position  and  boundary  temperatures  may  be  time 
and  position  dependent.  The  boundary  conditions,  which  may  be  surface-to-environment 
or  surface-to-surface,  may  be  specified  temperatures  or  any  combination  of  prescribed  heat 
flux,  forced  convection,  natural  convection,  and  radiation.  The  boundary  condition 
parameters  may  be  time-  and/or  temperature-  dependent.  General  graybody  radiation 
problems  may  be  modeled  with  user-defined  factors  for  radiant  exchange.  The  mesh 
spacing  may  be  variable  along  each  axis.  HEATING  uses  a  run-  time  memory  allocation 
scheme  to  avoid  having  to  recompile  to  match  memory  requirements  for  each  specific 
problem.  HEATING  utilizes  free-form  input.”  [7]. 

This  work  uses  the  finite  element  program  to  model  the  PBMR  reactor  cavity  and 
its  surroundings  with  cylindrical  and  cylindrical  shell  regions.  HEATING  has  advantages 


and  disadvantages  for  these  analyses.  The  advantage  is  that  most  of  the  components  being 
modeled  are  actually  cylindrical  in  shape.  Unfortunately,  HEATING  can  not  account  for 
the  movement  of  fluid  or  conservation  of  mass.  This  limitation  is  a  problem  when  the 
RCCS  cylinders,  which  are  filled  with  boiling  water,  are  being  analyzed.  It  is  not  possible 
to  accurately  simulate  the  boiling  and  mixing  of  water  in  the  cylinders  and  the  loss  of  mass 
due  to  boil  off  of  the  water.  In  one  portion  of  this  analysis,  this  limitation  is  overcome  by 
using  the  total  heat  transfer  between  the  reactor  and  RCCS  to  estimate  the  time  at  which 
sufficient  water  is  boiled  off  to  render  the  RCCS  inoperable. 

5.2  PBMR  Heat  Transfer  Model 


The  reactor  cavity  is  assumed  to  be  surrounded  by  soil.  This  assumption  was  made 
in  order  to  ease  calculations.  Because  of  the  very  slow  heat  transfer  rate,  the  lower 
boundary  of  this  model  is  assumed  to  be  26.63  m.  There  are  26  regions  in  the  model.  The 
total  number  of  nodes  in  the  model  is  2342.  Figures  5.1a  and  5.1b  are  diagrams  of  the 
different  regions  of  the  heat  transfer  model. 

Initial  equilibrium  cycle  core  conditions  obtained  from  the  VSOP  code  were 
assumed  to  exist  at  the  time  of  shutdown.  Table  5.1  shows  the  initial  conditions  used  for 
the  model.  Where  the  temperature  is  spatially  dependent,  the  figures  that  display  them  are 
identified  in  the  table.  The  core  modeled  was  the  Eskom  pebble-bed  reactor  being 
proposed  in  South  Africa,  which  is  being  used  by  MIT  as  the  reference  core  design.  The 
KFA  decay  heat  curve  was  assumed. 

Table  5.1  PBMR  Model  Initial  Conditions 


Region 

Initial  Temperature  (°C) 

The  Core 

Figure  5.2 

Figure  5.3 

Side  Reflector 

Figure  5.4 

Helium  Gap 

279 

Pressure  Vessel 

279 

Air  Gap 

150 

RCCS 

100 

Concrete  Wall 

50 

Earth 

35 

25 


Figure  5.1a  PBMR  Heat  Transfer  Model  Regions 
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Figure  5.1b  Detailed  View  of  Heat  Transfer  Regions 
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Temperature  of  Core  Regions 


Figure  5.3  Initial  Temperature  of  the  Upper  Helium  Gap  and  Top  Reflector 


Figure  5.4  Initial  Temperature  of  the  Side  Reflector 


The  core  barrel  region,  which  is  made  of  steel  of  small  thickness  and  high  thermal 
conductivity  relative  to  the  other  materials,  is  neglected  because  of  its  low  thermal 
resistance.  For  the  steam  blanketing  casualty,  several  data  runs  are  conducted  for  various 
conditions  in  the  gap  between  the  reactor  vessel  and  the  boundaries.  The  goal  for  this 
portion  of  the  analysis  is  to  determine  the  effect  water  vapor  in  the  reactor  cavity  has  on 
the  maximum  fuel  and  vessel  temperatures. 

Decay  Heat  Generation 

After  reactor  shutdown,  fission  power  induced  by  delayed  neutrons  subsides 
rapidly  and  thereafter,  the  heat  released  by  radioactive  decay  of  fission  products  dominates 
the  reactor  power.  The  decay  heat  depends  primarily  on  the  operating  history  of  the 
reactor,  including  the  reactor  power  level  prior  to  shutdown,  and  on  the  duration  of  the 
shutdown  period.  The  following  empirical  formula  from  is  used  to  approximate  the  power 
released  by  radioactive  decay  [8]: 

Qnrito,  ts)=QTA(ts  -*-(  t0  +  tsya)  (5.1) 

Where: 

Qr  =  reactor  power  prior  to  shutdown, 
ts  =  reactor  shutdown  time, 
to  =  reactor  operating  time,  and 

A  and  a  are  constants  given  for  different  time  intervals  in  Table  4.3. 


Table  5.2  Constants  A  and  a  in  Eq.  (5.1) 


Time  Intervals  (seconds) 

A 

a 

■IiUMWIi— 1^— i 

0.0603 

0.0639 

101<ts<1.5*10z 

0.0766 

0.181 

0.130 

0.283 

^onovts^-ono8 

0.266 

0.335 

Figure  5.5  displays  the  decay  heat  curve  with  respect  to  time  after  shutdown.  The  power 
curves  for  the  5  core  regions  are  shown  in  Figure  5.6. 
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Figure  5.5  Decay  Heat  vs.  Time 
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Figure  5.6  Power  Densities  of  the  Core  Regions 


The  materia]  properties  used  in  this  analysis  are  obtained  from  various  sources  [9, 
10,  11,  12].  The  properties  required  for  input  into  the  finite  element  analysis  program  are: 
specific  heat,  density,  and  conductivity.  The  values  for  some  of  these  properties  vary  with 
temperature.  Tabular  values  are  entered  into  the  input  file  so  that  the  various  material 
regions  can  be  modeled  properly.  HEATING  uses  linear  interpolation  to  determine  values 
of  properties  between  tabular  input  points.  For  the  heat  transfer  calculations  the  RCCS 
was  assumed  to  be  a  constant  100  °C  for  one  of  the  casualties. 

5.3  Radiation  Heat  Transfer 

The  modeling  of  radiation  heat  transfer  through  the  gap  between  the  reactor  vessel 
and  the  RCCS  cylinders  was  the  most  difficult  portion  of  this  analysis.  Several  methods 
were  tried  before  a  final  analytical  technique  was  chosen.  Radiation  heat  transfer  is  the 
primary  means  by  which  heat  is  removed  from  the  core.  Convection  heat  transfer  was 
found  to  be  significant  at  normal  operating  temperatures  but  less  significant  at  higher 
vessel  temperatures.  Conduction  through  the  gap  was  found  to  be  very  small.  Models  in 
which  only  conductivity  was  used  to  cool  the  core  showed  that  vessel  and  fuel 
temperatures  exceeded  design  limits.  This  was  due  to  the  low  densities  in  the  gap  between 
the  reactor  vessel  and  the  RCCS  cylinders.  The  total  heat  transfer  through  the  gap  was 
found  by  combining  the  calculated  heat  fluxes  from  radiation,  convection,  and  conduction. 

The  radiation  heat  transfer  through  the  gap  was  analyzed  for  various  mixtures  of 
steam  and  air.  Air  was  effectively  transparent  to  thermal  radiation  for  this  size  of  gap  (.9 
meters)  between  the  RCCS  cylinder  and  the  reactor  vessel.  The  amount  of  radiation 
transferred  between  two  gray  surfaces  without  the  interference  of  an  absorbing  gas  in 
between  them  is  found  using  the  following  [11,  12]: 


!  ^  (5.2) 

2, 

Where: 

q„et:  Heat  Flux  (W/m2) 

Evessei*  Black  Body  Radiation  of  Vessel  (W/m2) 
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Erccs'-  Black  Body  Radiation  of  RCCS  (W/m2) 

£vessei-  Vessel  Surface  Emissivity 
Erccs:  RCCS  Surface  Emissivity 

Blackbody  radiation  is  found  using  the  following  equation 


E Blackbody  ~ 


(5.3) 


Where: 

a:  Stephan-Boltzmann  Constant  (  5.67*1  O'8  W/  m2K4) 

T:  Surface  Temperature  (K) 

Steam  is  not  transparent  to  thermal  radiation.  Therefore  the  heat  transferred  from 
the  vessel  to  the  RCCS  cylinders  varies  with  the  amount  of  steam  in  the  gap.  The  radiation 
heat  transfer  is  affected  by  changes  in  the  emissivity  of  the  steam  in  the  gap.  Figure  5.7  is 
a  graph  of  the  total  emissivity  versus  temperature  for  various  pressure-thicknesses  of  steam 
[11].  The  pressure-thickness  is  a  measure  of  the  amount  of  steam  radiation  must  pass 
through.  For  this  analysis  the  maximum  pressure  of  water  vapor  was  assumed  to  be  1 
atmosphere,  i.e.  the  reactor  cavity  is  completely  filled  with  steam.  The  pressure  relief 
system  for  the  citadel  actuates  at  pressures  slightly  above  atmospheric.  The  actuation  of 
this  system  combined  with  the  fact  that  other  gases  will  always  be  present  in  the  reactor 
cavity  results  in  a  maximum  pressure  thickness  of  .9  atmosphere-meters  of  water  vapor, 
since  the  approximately  .9  metes. 

The  steam  attenuates  some  of  the  thermal  radiation  from  the  reactor  vessel. 
Reference  [12]  discusses  the  radiation  transferred  between  parallel  plates  through  a  gray 
gas.  Figure  5.8  is  a  graph  that  shows  the  effective  heat  transfer  between  two  blackbodies 
with  respect  to  the  optical  thickness  of  the  slab  of  gray  gas  between  them.  The  optical 
thickness  for  the  steam  in  the  gap  is  one  half  of  its  emissivity.  This  graph  is  equally  valid 
for  determining  the  radiation  heat  transfer  between  gray  surfaces.  Therefore,  in  order  to 
determine  the  effective  heat  transferred,  the  heat  flux  calculated  using  equation  5.3  is 
multiplied  by  the  appropriate  attenuation  factor.  This  factor  is  found  by  using  the 
corresponding  total  flux  line  of  Figure  5.8  for  the  optical  thickness  of  the  water  vapor  in 
the  gap. 
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Figure  5.8  Net  Radiative  Flux  through  a  Gray  Gas  [12] 

As  is  discussed  elsewhere  in  this  report,  the  effect  of  steam  on  RCCS  performance 
was  found  to  be  relatively  small.  The  casualty  of  operators  failing  to  refill  the  RCCS  uses 
a  different  approach  to  perform  the  heat  transfer  analysis.  The  RCCS  is  assumed  to  stay  at 
100  °C  until  the  system  ceased  to  function  at  approximately  three  days.  Instead  of  using 
analytical  solutions  to  solve  for  the  heat  flux  and  then  specifying  the  heat  flux  to  the  finite 
element  program,  a  radiation  heat  transfer  coefficient  is  determined.  This  heat  transfer 
coefficient  is  used  in  the  finite  element  model  to  determine  the  radiation  heat  flux  off  of  the 
vessel.  The  two  methods  used  for  analyzing  the  radiation  heat  flux  have  very  similar 
results.  The  second  method  used  to  calculate  the  radiation  heat  flux  from  the  vessel  to  the 
cylinders  is  [7]: 

q”  =  hr*  (T vessel2  '  TrccS2)  *  (Tvessel  '  TrccS  )  (5.4) 

Where: 

q”:  Heat  Flux  (W/m2) 

Tvessei-  Reactor  Vessel  Temperature 
Trccs:  RCCS  Cylinder  Temperature 
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lv:  Radiative  Heat  Transfer  Coefficient 


h  - - 

1  /  £ j  +  ( Aj  /  A2  )(1  /  £ 2  ~  1) 

Where: 

a:  Stephan-Boltzmann  Constant  ( 5.67*  10‘8  W  /  m2  K4 ) 
gj:  Higher  Temperature  Surface  Emissivity 
82:  Lower  Temperature  Surface  Emissivity 
Aj:  Higher  Temperature  Surface  Area  (nr) 

A2:  Lower  Temperature  Surface  Area  (m2  ) 


5.4  Natural  Convection  between  Vessel  and  RCCS 

The  natural  convection  heat  transfer  between  the  reactor  vessel  and  the  surrounding 
water-filled  RCCS  cylinders  is  affected  by  the  composition  of  the  mixture  in  the  gap 
between  the  two  surfaces.  The  RCCS  system  consists  of  45  cylinders  and  the  gaps 
between  cylinders  is  bridged  with  a  thermal  shield.  The  natural  circulation  in  this  region  is 
driven  by  the  vessel  being  significantly  higher  that  the  RCCS  cylinder.  The  resulting  flow 
is  up  along  the  reactor  vessel  surface  then  down  along  the  RCCS.  In  order  to  enable  an 
analytical  solution  to  be  found  the  RCCS  is  modeled  as  a  flat  cylindrical  shell. 

There  are  two  non-dimensional  numbers  that  are  important  when  evaluating  natural 
convection  between  two  surfaces:  Rayleigh  number  and  Nusselt  number.  The  Rayleigh 
number  is  the  non-dimensional  relation  between  buoyancy  and  viscosity  forces.  The 
Nusselt  number  is  the  non-dimensional  heat  transfer.  For  a  cylinder  surrounded  by  a 
cylindrical  shell  the  equations  for  the  Rayleigh  and  Nusselt  numbers  are  [11]: 


Ra = 

va 


(5.6) 


Nu  =  0.09  Ra278  (D</Di)34+-329  M  (1/H)0122(D/L)  ln(Do/Dj)  (5.7) 


Where: 

Ra:  Rayleigh  number 
g:  gravitational  constant  (9.81  m/s2) 
Tj:  temperature  of  inner  surface 


T0:  temperature  of  outer  surface 
B:  coefficient  of  thermal  expansion 
L:  characteristic  length:  L  =  (D0-Di)/2  =  .8  meters 
v:  kinematic  viscosity 

H:  height  of  cylinders 

The  validity  for  Nusselt  number  equation  is  valid  for  the  ranges:  Ra<106,  2  < 
(D(/Di)  <  15, 1  <  H/L  <  L.  For  the  problem  of  convection  heat  transfer  between  the  reactor 
vessel  and  the  RCCS  cylinders  the  following  relations  apply: 

H/L  =  12.5 
D0/Di  =  1.27 
Ra  =  5-10 8 -2-10  9 

The  Rayleigh  number  is  well  beyond  the  valid  range  for  the  Nusselt  number 
equation.  The  range  is  exceeded  due  to  the  fact  that  the  gap  between  the  two  surfaces  is 
relatively  small;  which  results  in  a  small  difference  in  surface  area.  The  values  for 
convective  heat  transfer  were  using  this  method  were  much  lower  than  those  calculated  by 
the  Eskom.  A  more  appropriate  way  to  solve  for  the  heat  transfer  is  treat  the  two  surfaces 
as  parallel  plates,  due  to  the  small  difference  in  surface  area.  The  Nusselt  number  for  this 
case  is  [10]: 


Nu  =.22 


Pr 


0.2 +  Pr 


Ra 


H_ 

L 


(5.8) 


Where: 

Pr:  Prandtl  number 

The  Prandtl  number  is  determined  from  the  physical  properties  of  the  mixture  in  the 
gap  between  the  two  surfaces.  All  properties  for  this  mixture  are  evaluated  at  the  mean 
temperature  of  the  two  surfaces.  The  RCCS  is  assumed  to  have  a  fixed  temperature  of  100 
°C  since  this  is  the  boiling  point  of  the  water  in  the  RCCS.  The  Nusselt  number  is  used  to 
determine  the  heat  transfer  coefficient  for  the  two  surfaces  then  the  natural  circulation  heat 


K 


NuL 

k 


(Jcortv  —  hConv'(  ^vessel  “ TrCCS  ) 


(5.9) 

(5.10) 


Where: 

2 

qconv*  convective  heat  flux  between  vessel  and  RCCS  (W/m  ) 
k :  thermal  conductivity  of  mixture  in  gap 

hconv •  convective  heat  transfer  coefficient 

The  convection  and  radiation  heat  fluxes  are  combined  with  the  conduction  heat 
flux  to  give  the  total  heat  flux  from  the  vessel  to  the  RCCS.  This  heat  flux  is  used  as  an 
input  for  the  vessel  region  defined  in  the  HEATING  finite  element  analysis.  It  is  then 
possible  to  determine  the  response  of  the  PBMR  for  various  mixtures  of  steam  and  air  in 
the  gap  between  the  vessel  and  the  RCCS  cylinders  by  varying  the  physical  properties  used 
in  the  calculations. 


5.5  Effect  of  Steam  on  the  Heat  Transfer  out  of  the  Reactor 
Vessel 

Steam  is  not  transparent  to  thermal  radiation  and  therefore  reduces  the  amount  of 
heat  transfer  out  of  the  vessel.  This  reduction  in  heat  transfer  results  in  elevated  core  and 
vessel  temperatures.  This  section  details  the  effect  of  changing  the  percentage  of  steam  in 
the  gap  on  the  total  heat  flux  out  of  the  vessel.  The  heat  flux  out  of  the  vessel  is  calculated 
for  ten  different  values  of  vessel  temperature.  All  of  the  physical  and  thermal  properties 
of  the  mixture  in  the  gap  were  found  using  the  average  temperature  of  the  vessel  and  the 
RCCS. 


Table  5.3  shows  the  conduction  heat  flux  values.  Table  5.4  contains  the  values  for 
convective  heat  flux.  Table  5.5  lists  the  radiation  heat  flux  between  the  vessel  and  the 
RCCS.  The  values  for  the  combined  heat  flux  are  given  in  Table  5.6.  The  values  of  heat 
flux  are  determined  for  steam  with  concentrations  of:  100,  75,  50,  25,  and  0  percent. 


Table  5.3  Conduction  Heat  Flux  out  of  Vessel 


Concentration  of  Steam 

1 

0.75 

0.5 

0.25 

0 

Temperature 

(°C) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

279 

6.46 

6.86 

7.26 

7.659 

8.059 

350 

10.333 

10.851 

11.37 

11.888 

12.406 

!  450 

16.29 

16.935 

17.579 

18.224 

18.869 

550 

23.413 

24.065 

24.717 

25.369 

26.021 

1  650 

31 .543 

32.104 

32.665 

33.226 

33.787 

750 

40.643 

41.025 

41.408 

41.79 

42.172 

850 

51.047 

51.047 

51.047 

51.047 

51.047 

950 

62.445 

61.944 

61.443 

60.942 

60.441 

1050 

75.154 

73.945 

72.735 

71.526 

70.317 

1150 

89.38 

87.259 

85.139 

83.019 

80.898 

Table  5.4  Convection  Heat  Flux  out  of  Vessel 


Concentration  of  Steam 

1 

0.75 

0.5 

0.25 

0 

Temperature 

(°C) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

279 

288.767 

293.508 

298.27 

302.869 

307.127 

350 

431.07 

437.102 

443.244 

449.264 

454.933 

450 

653.353 

658.724 

664.337 

669.885 

675.052 

550 

885.068 

888.266 

891.926 

895.701 

899.216 

650 

1.12E+03 

1.12E+03 

1.12E+03 

1.12E+03 

1.12E+03 

750 

1.36E+03 

1 .36E+03 

1.35E+03 

1.35E+03 

850 

1.63E+03 

1.61E+03 

1.60E+03 

1.58E+03 

1.56E+03 

950 

1.89E+03 

1.86E+03 

1.83E+03 

1.81E+03 

1.78E+03 

1050 

2.24E+03 

2.18E+03 

2.12E+03 

2.06E+03 

2.00E+03 

1150 

2.72E+03 

2.59E+03 

2.47E+03 

2.34E+03 

2.21  E+03 
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Table  5.5  Radiation  Heat  Flux  out  of  Vessel 


(°C) 


279 


350 


450 


550 


650 


750 


850 


950 


1050 


1150 


950 


1050 


1150 


Concentration  of  Steam 

1 

0.75 

0.5 

0.25 

0 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

Heat  Flux 
(w/m2) 

2.04  E+03 

2.09E+03 

2.17E+03 

2.30E+03 

2.55E+03 

3.65E+03 

3.74E+03 

3.88E+03 

4.11  E+03 

4.56E+03 

7.06E+03 

7.24E+03 

7.50E+03 

7.94E+03 

8.83E+03 

1 .22  E+04 

1 .25  E+04 

1 .30E+04 

1.38E+04 

1 .53  E+04 

1.97E+04 

2.01  E+04 

2.09E+04 

2.21  E+04 

2.46E+04 

2.99E+04 

3.07E+04 

3.18E+04 

3.37E+04 

3.74E+04 

4.37E+04 

4.48E+04 

4.64E+04 

4.92E+04 

5.46E+04 

6.17E+04 

6.32E+04 

6.55E+04 

6.94E+04 

7.71  E+04 

8.47E+04 

8.68E+04 

9.00E+04 

9.53E+04 

1 .06E+05 

1.14E+05 

1.16E+05 

1.21E+05 

1.28E+05 

1 .42E+05 

Table  5.6  Total  Heat  Flux  out  of  Vessel 


Concentration  of  Steam 


0.75  0.5  0.25 


Heat  Flux 
(w/m2) 


2.34E+03 


4.09E+03 


7.73E+03 


1.31E+04 


2.08E+04 


3.13E+04 


4.54E+04 


6.36E+04 


8.70E+04 


1.16E+05 


Heat  Flux 
(w/m2) 


2.39E+03 


4.19E+03 


7.91  E+03 


1.34E+04 


2.13E+04 


3.21  E+04 


4.65E+04 


6.51  E+04 


8.90E+04 


1.19E+05 


Heat  Flux 
(w/m2) 


2.48E+03 


4.33E+03 


8.18E+03 


1.39E+04 


2.20E+04 


3.32E+04 


4.81  E+04 


6.74E+04 


9.22E+04 


1.23E+05 


2.61  E+03 


4.57E+03 


8.63E+03 


1 .47  E+04 


2. 33  E+04 


3.51  E+04 


5.08E+04 


7.13E+04 


9.74E+04 


1.30E+05 


Heat  Flux 
(w/m2) 


2.87E+03 


5.03E+03 


9.52E+03 


1 .62E+04 


2.57E+04 


3.88E+04 


5.62E+04 


7.89E+04 


1.08E+05 


1.44E+05 
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5.6  Structural  Analysis  of  Reactor  Vessel 


Elevated  vessel  temperatures  which  exceed  the  design  temperature  limit  can  result 
in  damage  to  the  vessel.  The  PBMR  vessel  is  made  out  of  S  A-508,  which  is  mild  steel. 
These  material  properties  of  mild  steel  vary  with  temperature.  Specifically,  the  yield 
strength  is  greatly  reduced  above  600  °C.  Table  5.7  is  a  summary  of  the  mechanical  and 
thermal  properties  of  mild  steel. 

Table  5.7  Mechanical  and  Thermal  Properties  of  Mild  Steel 


Temp 

°C 

Yield 

Stress 

(Mpa) 

Young’s 

Modulus 

(Cpa) 

Poisson's 

Ratio 

Thermal 

Exp. 

Coefficient 

(10'1 2 3 * * 6/°C 

0 

290 

200 

0.3 

10 

100 

260 

200 

0.3 

11 

300 

200 

200 

0.3 

12 

450 

150 

150 

0.3 

13 

550 

120 

110 

0.3 

14 

600 

110 

88 

0.3 

14 

720 

9.8 

20 

0.3 

14 

800 

9.8 

20 

0.3 

15 

1550 

0.98 

0.2 

0.3 

The  highest  temperature  on  the  modeled  vessel  is  found  at  its  vertical  center.  This 
region  is  called  the  beltline.  As  the  temperature  increases  the  modulus  of  elasticity  and 
yield  strength  are  reduced.  If  the  vessel  temperature  is  high  enough  the  following 
sequence  of  events  could  occur: 

1.  Temperature  increases  due  to  impairment  of  the  RCCS. 

2.  Yield  strength  decreases  and  plastic  deformation  starts  and  can  lead  to  a  rupture 
in  the  beltline  region. 

3.  The  rupture  results  in  the  internal  pressure  equalizes  with  external  pressure. 

Citadel  over-pressure  system  actuates  removing  the  helium  from  the  reactor 

cavity  and  PCU  space.  The  Citadel  consists  of  the  reactor  cavity  and  PCU 

spaces. 


4.  Pressure  stress  drops  rapidly.  The  weight  of  the  upper  vessel  head  and  vessel 
cylindrical  shell  create  a  compressive  stress: 

•  If  the  compressive  stress  exceeds  the  yield  stress  the  vessel  will  plastically 
deform  around  the  point  of  fracture. 

•  This  compressive  stress  can  cause  the  vessel  to  buckle  if  it  exceeds  the 
critical  buckling  stress  of  the  vessel. 

5.  Catastrophic  failure  of  the  vessel  can  result  in  mechanical/thermal  shock  and/or 
chemical  attack  of  the  fuel  pebbles. 

6.  Damage  to  fuel  causes  fission  products  to  be  released  to  the  reactor  cavity. 

7.  Fission  products  escape  the  citadel  via  the  pressure  relief  system  as 
compartment  temperatures  rise  and  cause  cavity  pressure  to  increase. 

The  reactor  vessel  is  a  cylindrical  with  elliptical  upper  and  lower  heads.  The 
internal  pressure  following  a  reactor  scram  is  4.8  MPa.  As  the  core  temperature  increases 
the  pressure  will  rise  due  to  expansion  of  the  helium  gas.  The  maximum  vessel  stress  is 
calculated  from  a  combination  of  circumferential  and  tensile  stresses.  The  equations  that 
determine  the  pressure  stress  in  the  vessel  are  [15]. 
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Where: 

Cee:  circumferential  stress 
Gxx:  axial  stress 
h:  thickness 

a:  average  radius 

p:  pressure 


The  maximum  stress  for  the  vessel  is  then  found  and  compared  to  the  yield 
strength.  If  the  maximum  stress  exceeds  the  yield  strength  of  the  vessel  material  plastic 
deformation  occurs  and  a  rupture  is  possible.  The  internal  pressure  equalizes  with  the 
external  pressure  when  the  vessel  ruptures. 

Once  the  pressure  equalizes,  the  stress  in  the  wall  becomes  compressive  due  to  the 
weight  of  the  upper  vessel.  The  compressive  stress  is  found  by  dividing  the  weight  of  the 
upper  portion  of  the  vessel  by  the  cross-sectional  area  of  the  shell.  Using  this  method  the 
maximum  compressive  stress  is  found  to  be  1.2  MPa.  The  vessel  is  then  analyzed  to 
determine  if  it  will  buckle.  Reference  [16]  discusses  cylindrical  vessels  in  compression 
from  an  axial  force.  In  order  to  determine  the  stress  at  which  the  buckling  will  occur  we 
use  the  following  equations  [16]: 
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Where: 

Oo-:  Critical  Stress 
ouit:  Ultimate  Stress 
Oyieia:  Yield  Stress 
v:  Poisson’s  Ratio 

The  critical  stress  equation  is  an  analytical  solution  using  the  Euler  method.  Test 
results  have  shown  that  vessels  in  axial  compression  fail  at  stress  levels  well  below  the 
critical  stress.  The  ultimate  stress  equation  is  based  on  empirical  results,  and  more 
accurately  predicts  the  vessel  behavior.  The  effects  of  vessel  temperature  on  the  structural 
response  of  the  PBMR  are  discussed  further  in  the  next  chapter. 


Chapter  6  Results  of  the  Analysis 

In  order  for  probabilities  of  failure  to  be  assigned  to  the  proposed  casualty  the 
effects  of  the  casualty  are  determined.  The  first  casualty  being  analyzed  is  a  rupture  in  a 
passive  cooling  system  (RCCS)  for  the  PBMR.  This  rupture  generates  steam  due  to  the 
cooling  water  splashing  on  the  hot  reactor  vessel.  As  discussed  in  chapter  5,  steam  in  the 
gap  reduces  the  amount  of  radiation  heat  transfer  from  the  vessel  to  the  RCCS.  The  second 
casualty  analyzed  was  failure  of  the  RCCS  due  to  operator  inaction.  The  operators  failing 
to  refill  the  RCCS  casualty  is  shown  to  be  a  much  more  limiting  case  than  steam 
blanketing  casualty.  This  chapter  summarizes  the  results  of  the  heat  transfer  analysis  for 
both  casualties.  Finally,  the  structural  response  of  the  vessel  to  the  temperature  transient  is 
discussed. 

6.1  Thermal  Response  Analysis  Results 
Steam  Blanketing 

This  analysis  section  deals  with  the  effect  that  steam  blanketing  of  the  reactor 
vessel  has  on  its  passive  heat  removal.  The  HEATING  model  of  the  PBMR  was  used  to 
predict  the  response  of  the  plant  to  various  concentrations  of  water  vapor  in  the  gap 
between  the  reactor  vessel  and  the  RCCS  cooling  cylinders.  The  results  of  these  analyses 
are  shown  in  Figures  6.1-6.10.  The  water  vapor  concentrations  used  in  the  analysis  are: 
100,  75,  50,  25,  and  0  percent. 

The  effect  on  the  water  vapor  on  the  passive  heat  removal  of  the  reactor  vessel  is 
not  as  great  as  initially  expected.  With  the  gap  filled  completely  with  steam  the  radiation 
heat  flux  is  reduced  by  20  percent.  The  presence  of  Steam  results  in  a  maximum  vessel 
temperature  increase  of  32  °C  above  the  maximum  vessel  temperature  with  only  air 
present.  Figure  6. 1 1  is  a  graph  of  maximum  core  temperature  versus  time  for  all  the 
different  gap  mixtures.  Figure  6. 12  is  a  graph  of  the  vessel  temperature  with  respect  to 
time  for  all  the  data  runs. 
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Distributions  w /  no  Steam  in  the  Annular  Region 


Figure  6.2  Axial  Vessel  Temp.  Distributions  w/  no  Steam  in  the  Annular  Region 


Figure  6.3  Radial  Temp.  Distributions  w /  25%  Steam  in  the  Annular  Region 


Figure  6.4  Axial  Vessel  Temp.  Distributions  w/  25%  Steam  in  the  Annular  Region 


Distributions  w/  50%  Steam  in  the  Annular  Region 


Figure  6.6  Axial  Vessel  Temp.  Distributions  w /  50%  Steam  in  the  Annular  Region 


Figure  6.8  Axial  Vessel  Temp.  Distributions  w /  75%  Steam  in  the  Annular  Region 


Distributions  w/ 100%  Steam  in  the  Annular  Region 


Figure  6.10  Axial  Vessel  Temp.  Distributions  w/ 100%  Steam  in  the  Annular  Region 


1600 


|  E  E  « 

E  $  03  CO  CD 

m  $  ®  ®  55 
®  10  55  S  ' 

C/D  ^  o- 

u  O 

o  in  o  m  o 
Z  c\j  in  n  t- 

(tin 


(00)  ajniBjadtuai 


Figure  6.11  Maximum  Core  Temperatures  vs.  Time 


Figure  6.12  Maximum  Vessel  Temperatures  vs.  Time 


RCCS  Failure  due  to  Operator  Inaction 

The  effect  of  steam  in  the  reactor  cavity  is  shown  to  be  relatively  small.  The 
second  casualty  more  directly  impairs  the  operation  of  the  RCCS.  The  system  will  stop 
removing  heat  from  the  reactor  cavity  when  a  significant  amount  of  the  water  in  the  tubes 
has  been  evaporated.  Operators  can  prevent  this  failure  by  adding  water  to  the  system. 
Operators  not  talcing  the  proper  action  could  be  the  result  of  either  operator  error  or  lack  of 
operator  access  to  the  facility. 

This  casualty  assumes  that  no  operator  action  is  taken  and  the  RCCS  completely 
fails  at  three  different  times.  The  amount  of  time  prior  to  RCCS  failure  is  determined  by 
comparing  the  heat  flux  transferred  from  the  reactor  vessel  to  the  RCCS.  This  heat  causes 
the  water  in  the  tubes  to  boil  off.  Therefore,  various  volumes  of  water  boiling  off  are 
associated  with  the  amount  of  time  it  took  to  evaporate  them.  At  approximately  3  days  70 
percent  of  the  water  is  evaporated.  The  actual  response  of  the  system  would  be  a  gradual 
reduction  in  the  rate  of  heat  transfer.  The  exact  time  that  the  RCCS  ceases  to  function  is 
unknown.  For  this  reason  three  different  start  times  for  the  casualty  are  analyzed:  72 
hours,  87  hours,  and  100  hours. 

First  the  response  of  the  PBMR  is  determined  assuming  no  failure  of  the  RCCS. 
The  cylinders  of  the  RCCS  are  assumed  to  stay  at  100  °C.  At  the  start  of  the  casualty  the 
boundary  conditions  of  the  inner  gap  between  the  RCCS  and  the  vessel  are  changed.  The 
RCCS  cylinders  are  allowed  to  heat  up  and  conduct  heat  to  the  outer  gap  between  the 
RCCS  and  the  cavity  wall.  The  material  properties  of  the  models  RCCS  region  are 
modified  to  simulate  the  fact  that  heat  from  the  vessel  is  conducted  around  the 
circumference  of  the  RCCS  cylinders  and  then  radiated  to  the  walls  of  the  cavity.  Figures 
6.13-20  show  the  temperature  responses  of  the  reactor  vessel  and  the  entire  reactor  cavity 
model  to  the  casualty  for  the  four  cases:  RCCS  functioning,  failure  at  72  hours,  failure  at 
87  hours,  and  failure  at  100  hours.  Figure  6.21  is  a  graph  of  the  maximum  core  and  vessel 
temperatures  for  the  four  cases.  We  see  that  excessive  vessel  temperatures  result  in  all  the 
cases  for  a  failed  RCCS. 
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Figure  6.13  Vessel  Temperature  with  RCCS  Functioning 


Radial  Position  (meters) 

Figure  6.14  Reactor  Cavity  Radial  Temperature  Profile  with  RCCS  Functioning 


Figure  6.1 5  Vessel  Temperature  with  RCCS  Failing  at  72  Hours 


Radial  Position  (meters) 

Reactor  Cavity  Radial  Temperature  Profile  with  RCCS  Failing  at  72  Hours 


Figure  6.17  Vessel  Temperature  with  RCCS  Failing  at  87  Hours 
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Radial  Position  (meters) 

Reactor  Cavity  Radial  Temperature  Profile  with  RCCS  Failing  at  87  Hours 


Figure  6.19  Vessel  Temperature  with  RCCS  Failing  at  87  Hours 


Reactor  Cavity  Radial  Temperature  Profile  with  RCCS  Failing  at  100  Hours 


Maximum  Core  and  Vessel  Temperatures  for  the  Four  Cases 


Discussion  of  the  Thermal  Analysis  Results 

The  two  previous  sections  dealt  with  the  results  of  the  thermal  analysis  of  the 
PBMR  for  the  two  different  casualties.  Both  of  these  casualties  involve  interfering  with 
the  inherent  heat  removal  capability  of  the  Reactor  Cavity  Cooling  System.  The  steam 
blanketing  case  is  shown  to  have  little  effect  on  the  safety  of  the  plant.  The  second 
casualty  results  in  direct  impairment  of  the  RCCS  due  to  operators  failing  to  replenish  the 
systems  supply  of  water.  The  cases  are  not  analyzed  beyond  the  222  hour  point.  In  all 
cases  with  a  failed  RCCS  the  temperatures  in  the  RCCS  cylinders  are  high  enough  to  cause 
their  mechanical  failure.  This  failure  would  have  resulted  in  a  change  in  the  reactor  cavity 
configuration;  therefore,  analysis  beyond  222  hours  is  deemed  not  useful. 

6.2  Results  of  PBMR  Structural  Analysis 

Section  5.6  discusses  how  vessel  stress  is  calculated.  As  the  vessel  temperature 
increases  two  things  happen.  The  helium  inside  the  reactor  vessel  undergoes  thermal 
expansion  and  compresses  the  rest  of  the  helium  in  the  attached  piping  resulting  in  a 
pressure  increase.  Also,  the  yield  strength  and  modulus  of  elasticity  of  the  vessel  material 
decreases  as  the  vessel  temperature  increases. 

Following  the  scram,  the  initial  pressure  in  the  PBMR  is  4.8  MPa.  This  pressure 
increases  as  the  temperature  of  the  helium  in  the  vessel  rises.  Correspondingly,  the  stress 
caused  by  the  internal  pressure  increases.  The  reactor  vessel  will  fail  when  this  stress 
reaches  the  yield  point  of  the  vessel  material.  Figure  6.22  is  a  graph  that  shows  the 
decreasing  yield  strength  plotted  against  temperature.  Plastic  deformation  begins  when  the 
yield  strength  reaches  the  vessel  stress.  The  core  temperature  in  the  analysis  was  relatively 
independent  of  the  vessel  temperature.  The  majority  of  the  pressure  increase  in  the  plant 
occurs  as  the  core  temperature  rises  to  its  maximum  value.  This  increase  in  pressure 
happens  before  the  vessel  temperature  starts  to  rise  in  the  casualties  evaluated.  The 
estimated  maximum  pressure  in  the  vessel  is  6.5  MPa.  This  pressure  results  in  a  maximum 
stress  of  1 15  MPa.  The  pressure  stress  and  the  SA  508  yield  stress  intersect  at 
approximately  500  °C. 
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Figure  6.22  Yield  Stress  versus  Temperature  of  Vessel  Material 


The  ductile  failure  of  the  vessel  will  eventually  lead  to  a  rupture  in  the  pressure 
boundary.  As  described  in  the  previous  chapter,  the  possibility  of  buckling  was  also 
examined.  Figure  6.23  is  a  graph  of  the  critical  and  ultimate  stresses  which  will  result  in 
buckling  and  the  maximum  compressive  stress  due  to  the  vessel  weight.  The  maximum 
compressive  stress  is  less  than  the  ultimate  stress  up  to  well  above  1,000  °C.  Therefore, 
buckling  is  deemed  not  to  occur  in  the  PBMR. 

When  the  RCCS  system  is  allowed  to  expend  its  water  supply  without  additional 
water  being  added,  the  vessel  temperatures  are  shown  to  rise  to  above  900  °C.  The  strain 
rates  of  vessel  material  also  increase  with  the  vessel  temperature.  Fracture  will  result  from 
the  increased  vessel  temperature.  This  fracture  will  release  the  helium  and  reduce  the 
vessel  internal  pressure.  The  vessel  stress  will  become  compressive.  Ductile  failure  will 
likely  continue  near  the  point  of  fracture  and  the  vessel  will  possibly  collapse  since  the 
fracture  will  act  as  a  stress  concentrator. 
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Figure  6.23  Bucking  Stress  in  PBMR  Vessel 


Chapter  7  Probabilistic  Assessment  of  PBMR  Casualties 


The  two  casualties  analyzed  in  Chapters  5  and  6  yield  very  different  results.  The 
steam  blanketing  casualty  is  shown  not  to  be  of  concern  for  the  safety  of  the  PBMR. 
Inaction  by  operators  to  refill  the  RCCS  is  shown  to  have  detrimental  effects  on  the 
Reactor  Unit.  Temperatures  of  the  vessel  are  high  enough  to  possibly  cause  catastrophic 
failure  of  the  pressure  vessel.  This  casualty  can  therefore  result  in  the  release  of  fission 
products  due  to  damage  of  the  fuel  pebbles.  This  chapter  deals  with  assigning  probabilities 
to  these  casualties  so  that  an  overall  judgment  can  be  made.  In  an  official  risk-based 
analysis  these  probabilities  would  be  assigned  by  establishing  a  commission  to  discuss 
each  event  in  the  fault  tree.  For  this  work,  the  author  assigned  the  event  probabilities  after 
consultation  with  members  of  the  Nuclear  Engineering  Department  of  the  Massachusetts 
Institute  of  Technology. 

7.1  Steam  Blanketing 

The  addition  of  steam  to  the  reactor  cavity  does  not  significantly  affect  the 
operation  of  the  PBMR  decay  heat  removal  system.  The  cavity  being  completely  filled 
with  steam  results  in  a  20  percent  reduction  in  graybody  radiation  heat  transfer.  This 
reduction  in  radiation  heat  transfer  leads  to  a  32  °C  temperature  rise  on  the  vessel.  This 
temperature  rise  is  not  enough  to  cause  damage  to  the  reactor  vessel.  Therefore,  the 
probability  that  this  casualty  will  result  in  fission  product  release  is  assigned  a  value  of 
zero. 

7.2  Probability  of  the  RCCS  failing  due  to  Operator  Inaction 

The  Reactor  Cavity  Cooling  System  can  operate  for  approximately  three  days 
without  being  filled  with  water  if  it’s  in  a  no  flow  condition.  A  large  earthquake  could 
knock  out  the  electrical  power  to  the  primary  and  backup  pumps  for  the  RCCS.  The 
probability  of  this  occurrence  is  associated  with  the  likelihood  of  an  earthquake  of 
sufficient  size  occurring  in  the  vicinity  of  the  power  plant.  The  probability  of  this 
occurrence  is  IE-4/year. 


For  this  casualty  to  have  an  effect  on  the  PBMR  safety;  operators  must  not  add 
water  to  the  RCCS  for  at  least  100  hours.  The  first  variable  in  this  casualty  is  the  time 
required  for  operators  to  take  the  correct  actions.  The  operators  could  fail  to  take  the 
appropriate  actions  for  one  of  two  reasons.  First,  the  earthquake  could  have  rendered 
access  to  the  PBMR  site  or  RCCS  piping  impossible.  Second,  the  operators  could  take 
improper  actions  relating  to  the  RCCS.  The  longer  it  takes  for  operators  to  respond 
correctly,  the  higher  the  possibility  of  damage  to  the  PBMR  vessel.  Another  variable  in 
the  analysis  is  the  time  at  which  the  RCCS  ceases  to  function  with  enough  capacity  to 
remove  the  decay  heat  generated  in  the  core.  Chapter  6  details  the  results  of  the  three 
different  initiation  times  for  complete  failure  of  the  RCCS.  In  reality  the  failure  would  be 
more  gradual,  but  Figure  6.22  shows  that  the  results  are  nearly  the  same  for  the  three 
different  cases  just  shifted  in  time. 

Due  to  analysis  of  how  much  energy  is  required  to  boil  the  water  in  the  RCCS  the 
probability  that  the  system  fails  before  72  hours  is  deemed  to  be  very  low.  After  72  hours 
the  probability  the  system  failing  would  increase  due  to  the  fact  that  there  is  a  fixed 
amount  of  water  in  the  cooling  cylinders.  The  mean  value  for  the  time  that  the  RCCS 
ceases  to  function  is  assigned  a  value  of  87  hours.  The  initial  rupture  of  the  system  should 
occur  before  the  vessel  reaches  700  °C  since  at  this  temperature  the  pressure  stress  is  10 
times  higher  that  the  yield  stress.  Using  Figures  6.21  and  6.22  a  mean  time  for  the 
catastrophic  failure  of  the  vessel  is  estimated  to  be  1 85  hours,  which  corresponds  to  an 
850  °C  vessel  temperature.  In  order  to  prevent  the  catastrophic  failure  of  the  vessel  the 
operators  must  respond  before  this  time.  Therefore  the  probability  of  this  event  is  based  on 
the  likelihood  that  operators  will  not  respond  properly  in  185  hours.  It  should  be  noted  that 
this  time  estimate  could  be  greatly  improved  by  more  accurate  mechanical  property  data 
for  the  vessel  material  and  testing  of  stress  concentrations  in  a  ruptured  cylindrical  shell. 
The  probability  of  the  operators  not  acting  in  time  is  IE-3. 

The  next  event  that  needs  to  occur  is  that  the  fuel  pebbles  must  be  damaged  in 
order  for  fission  products  to  be  released.  Several  factors  affect  the  possibility  of  this  event. 
Following  the  failure  of  the  vessel  the  fuel  could  be  damaged  by  mechanical  shock, 
thermal  shock,  or  chemical  attack.  All  of  these  events  are  likely  if  there  is  a  catastrophic 


failure  of  the  reactor  vessel.  The  probability  of  fuel  damage  is  therefore  given  a 
probability  of  0.75  if  the  vessel  has  failed. 

The  final  event  that  must  occur  is  that  the  fission  products  are  transferred  out  of  the 
PBMR  containment  area.  The  fission  products  could  be  entrained  with  helium  in  the 
cavity  and  carried  out  very  the  pressure  relief  system.  The  relief  system  could  have  failed 
open  during  the  vent  off  of  the  helium.  The  rupture  disc  in  the  vent  pipe  could  have  blown 
and  its  protective  valve  failed  open.  Any  of  these  occurrences  could  result  in  fission 
product  release  to  the  environment.  The  probability  of  this  event  occurring  assuming  that  a 
large  earthquake  has  already  occurred  is  0.001. 

The  probability  of  fission  product  release  is  obtained  by  combining  all  the 
probabilities  above.  The  calculated  probability  for  this  casualty  affecting  the  surroundings 
is  therefore  7.5E-1 1/year.  This  probability  would  be  combined  with  all  the  other  possible 
casualties  that  could  lead  to  fission  product  release  to  the  environment.  These  other 
casualties  would  have  to  be  analyzed  and  assigned  the  appropriate  probabilities  of 
occurrence. 
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Chapter  8  Conclusions  and  Future  Work 


The  purpose  of  this  work  was  to  analyze  the  PBMR  reactor  to  determine  if  its 
inherently  safe  design  warranted  use  of  a  non-standard  containment  system.  This 
determination  was  to  be  based  on  the  probability  of  fission  product  release  for  casualties 
which  impaired  the  decay  heat  removal  capability  of  the  reactor.  The  initiating  event  for 
both  of  the  casualties  was  a  beyond  design  basis  earthquake. 

The  first  casualty  was  steam  blanketing  of  the  Reactor  Unit  by  water  released  from 
a  ruptured  RCCS  cylinder.  The  deterministic  analysis  portion  of  this  work  showed  that  the 
reduction  in  radiation  heat  transfer  due  to  the  presence  of  water  vapor  was  negligible,  and 
had  no  effect  on  reactor  safety.  The  second  casualty  was  the  loss  of  the  RCCS  due  to 
operators  not  replenishing  the  water.  This  event  resulted  in  vessel  temperatures  in  excess 
of 900  °C.  If  proper  action  was  not  taken  within  a  given  amount  of  time  catastrophic 
failure  of  the  reactor  vessel  could  occur.  The  likelihood  of  this  event  was  assessed  to  be 
7.5E-1 1/year.  This  risk  would  be  combined  with  the  risk  of  all  the  other  possible 
occurrences  that  could  result  in  fission  product  release  to  obtain  the  total  risk  to  the  public. 
The  analysis  in  this  work  has  shown  that  the  Eskom  assertion  of  the  PBMR  not  requiring  a 
standard  containment  system  is  justified  for  the  evaluated  casualties. 

Here  are  some  recommendations  for  further  analysis  into  risk  based  licensing  of  the 
PBMR.  Future  efforts  should  be  directed  into  further  identifying  casualties  that  are 
specific  to  PBMR  reactor  design.  A  Computational  Fluid  Dynamics  program  should  be 
used  in  follow-on  analysis  to  overcome  the  limitations  of  HEATING.  A  group  of  experts 
should  be  involved  in  assigning  the  probabilities  to  the  individual  components  of  the 
casualty  risk  analysis. 
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Appendix  A:  RCCS  Addition  Information  [5] 


The  purpose  of  the  RCCS  is  to  transfer  to  the  sea  (or  to  the  atmosphere,  when  the  sea  water 
system  is  not  available),  the  heat  from  the  reactor  cavity  during  all  modes  of  reactor 
operation,  including  a  Pressurized  or  Depressurized  Loss  of  Forced  Cooling  (PLOFC  or 
DLOFC)  event,  thereby  protecting  the  concrete  wall  of  the  cavity,  and  ensuring  that  the 
maximum  Reactor  Pressure  Vessel  (RPV)  and  fuel  temperatures  are  not  exceeded. 

Natural  processes,  for  instance,  thermal  radiation  and  convection,  transport  the  heat  from 
the  reactor  vessel  walls  to  the  cooling  chambers  of  the  cavity  cooling  system. 

The  RCCS  is  a  three-loop  system  of  large  water  chambers  surrounding  the  reactor.  Heat 
absorbed  by  the  water  is  pumped  to  plate  heat  exchangers  where  it  is  transferred  to  the 
UHSS.  The  UFCS  is  a  water-cooled  system  operating  in  parallel  with  the  RCCS,  and  using 
the  same  pumps  and  heat  exchangers  as  the  RCCS.  Water  can  be  directed  to  either  the 
RCCS  or  the  UFCS,  or  to  both,  and  both  are  backed-up  by  the  cooling  towers.  Both  can 
operate  in  passive  mode  when  required. 

The  UFCS  consists  of  an  annular  tank  with  a  water  jacket.  Decay  heat  from  the  fuel  is 
transferred  to  the  water  in  the  jacket,  the  hot  water  then  being  pumped  to  the  RCCS  heat 
exchangers. 

The  RCCS  is  designed  to  remove  the  specified  waste  heat  from  the  reactor  cavity  under  all 
operating  conditions.  It  is  a  water-based  system  made  up  of  proven  plate  heat  exchangers, 
pumps,  valves  and  pipework.  All  operating  pumps  have  standby  units  which  will 
automatically  come  on  line  in  the  event  of  a  failure  of  an  operational  unit.  Valves  are 
generally  kept  in  the  open  position,  being  closed  manually  for  maintenance  purposes. 

In  addition  to  having  back-up  cooling  towers,  the  RCCS  has  a  passive  mode  of.  operation 
in  that  water  contained  in  these  systems  can  be  allowed  to  boil  off  over  a  period  of 
approximately  three  days,  sufficient  to  allow  the  fuel  heat  to  decay  to  a  safe  level. 
Additional  water  from  an  outside  source  can  also  be  introduced  to  replenish  water  lost 
through  evaporation.  The  period  of  three  days  is  based  on  50%  of  the  water  boiling  away, 
the  heat  load  being  1  100  kW  as  expected  under  DLOFC  conditions. 


The  systems  are  fitted  with  temperature,  pressure  and  level  indicators,  and  facilities  are 
available  for  extracting  samples  on  a  regular  basis. 

All  components  of  the  RCCS  and  UFCS  have  a  design  pressure  rating  of  1  MPa,  while 
operating  pressures  are  not  expected  to  exceed  0.5  MPa. 

The  schematic  layout  of  the  RCCS  and  UFCS  is  shown  in  the  figure  on  the  next  page.  The 
RCCS  consists  of  three  identical  cooling  trains,  where  each  train  is  an  independent,  low- 
pressure,  closed-loop,  pump-driven,  water-based  cooling  system 

Within  the  reactor  cavity,  the  system  consists  of  a  series  of  45  low  carbon  steel  water 
chambers,  each  approximately  500  mm  in  diameter  and  22  m  long,  arranged  vertically 
around,  and  concentric  to,  the  RPV.  The  chamber  wall  thickness  is  10  mm.  Three  150  mm 
diameter  inlet  and  three  outlet  headers  are  arranged  around  the  top  of  the  chambers.  Each 
outlet  header  transports  hot  water  to  a  heat  exchanger  situated  outside  the  reactor  cavity, 
after  which  it  is  pumped  back  into  the  corresponding  inlet  header.  From  each  inlet  header, 
feed  lines  enter  the  top  of  every  third  chamber,  then  run  down  the  inside  of  the  chamber  to 
discharge  cold  water  at  the  bottom. 

The  entire  chamber  structure  is  suspended  from  a  support  ring  resting  on  the  concrete  wall 
of  the  reactor  cavity,  thereby  allowing  free  expansion  and  contraction.  Anti-syphoning 
devices  are  fitted  to  prevent  the  chambers  from  being  emptied  in  the  event  of  a  low-level 
break  in  the  pipework  outside  of  the  reactor  cavity,  and  the  trains  are  connected  to  fixed 
water  make-up  lines  fed  from  the  existing  Koeberg  facilities. 

Each  cooling  train  has  its  own  plate  heat  exchanger  and  two  100%  pumps.  These  are 
situated  on  the  -19  m  level  of  the  Module  Building.  The  three  trains  are  backed  up  by  two 
50%  cooling  towers  situated  on  the  roof  of  the  module.  Each  tower  has  two  100%  main 
circulating  pumps  and  two  100%  spray  pumps. 


